1 chapter10 Recovering Graphics Files After reading this chapter and completing the exercises, you will be able to: Desc... Show chapter 10 Recovering Graphics Files After reading this chapter and completing the exercises, you will be able to: • Describe types of graphics file formats • Explain types of data compression • Explain how to locate and recover graphics files • Describe how to identify unknown file formats • Explain copyright issues with graphics 381 382 Chapter 10 Many computer forensics investigations involve graphics, especially those downloaded from the Web and circulated via e-mail. To examine and recover graphics files, you need to understand the basics of computer graphics, including file characteristics, common file formats, and compression methods for reducing file size. This chapter begins with an overview of computer graphics and data compression, and then explains how to locate and recover graphics files based on information stored in file headers. You learn how to identify and reconstruct graphics file fragments, analyze graphics file headers, and repair damaged file headers. This chapter also explores tools for viewing graphics files you recover and discusses two computer graphics issues: steganography and copyrights. Steganography involves hiding data, including images, in files. Copyrights determine the ownership of media, such as images downloaded from a Web site. Recognizing a Graphics File Graphics files contain digital photographs, line art, three-dimensional images, and scanned replicas of printed pictures. You might have used a graphics program, such as Microsoft Paint, Adobe Photoshop, or Gnome GIMP, to create or edit an image. A graphics program creates one of three types of graphics files: bitmap, vector, and metafile. Bitmap images are collections of dots, or pixels, in a grid format that form a graphic. Vector graphics are based on mathematical instructions that define lines, curves, text, ovals, and other geometric shapes. Metafile graphics are combinations of bitmap and vector images. You can use two types of programs to work with graphics files: graphics editors and image viewers. You use graphics editors to create, modify, and save bitmap, vector, and metafile graphics. You use image viewers to open and view graphics files but not change their contents. When you use a graphics editor or an image viewer, you can open a file in one of many graphics file formats, such as .bmp, .gif, or .eps. Each format has different qualities, including the amount of color and compression it uses. If you open a graphics file in a graphics editor that supports multiple file formats, you can save the file in another file format. However, converting graphics files in this way can change the image quality, as you see in a Hands-On Project at the end of this chapter. Understanding Bitmap and Raster Images Bitmap images store graphics information as grids of pixels, short for “picture elements.” Raster images are also collections of pixels, but they store pixels in rows to make images easy to print. In most cases, printing an image converts, or rasterizes, it to print pixels line by line instead of processing the complete collection of pixels. A bitmap’s image quality on a monitor is governed by resolution, which determines the amount of detail that’s displayed. Resolution is related to the density of pixels onscreen and depends on a combination of hardware and software. Monitors can display a range of resolutions; the higher the resolution, the sharper the image. Computers also use a video card containing a certain amount of memory for displaying images. The more advanced the video card’s electronics and the more memory it has, the more detailed instructions it can accept, resulting in higher-quality images. For example, the monitor and video card on your Windows computer might support a 1024 × 768 resolution, which means displaying 1024 pixels horizontally and 768 pixels vertically. Recognizing a Graphics File 383 The more pixels displayed, the smaller they must be to fit onscreen and, therefore, the smaller pictures appear onscreen. Because a bitmap image is defined by pixel size, high-resolution images use smaller pixels than low-resolution images do. Software also contributes to image quality. Software includes drivers, which are coded instructions that set a video card’s display parameters, and programs used to create, modify, and view images. With some programs, such as IrfanView (www.irfanview.com), you can view many types of images; with other programs, you can view or work with only the graphics files they create. Computer graphics professionals use programs that support high resolutions to have more control over the display of bitmap images. However, bitmaps, especially those with low resolution, usually lose quality when you enlarge them. Another setting that affects image quality is the number of colors the monitor displays. Graphics files can have different amounts of color per pixel, but each file must support colors with bits of space. The following list shows the number of bits per colored pixel: • 1 bit = 2 colors • 4 bits = 16 colors • 8 bits = 256 colors • 16 bits = 65,536 colors • 24 bits = 16,777,216 colors • 32 bits = 4,294,967,296 colors Bitmap and raster files use as much of the color palette as possible. However, when you save a bitmap or raster file, the resolution and color might change, depending on the colors in the original file and whether the file format supports these colors. Understanding Vector Graphics Vector graphics, unlike bitmap and raster images, use lines instead of dots to make up an image. A vector file stores only the calculations for drawing lines and shapes; a graphics program converts these calculations into an image. Because vector files store calculations, not images, they are generally smaller than bitmap files, thereby saving disk space. You can also enlarge a vector graphic without affecting image quality—to make an image twice as large, a vector graphics program, such as CorelDRAW and Adobe Illustrator, computes the image mathematically. Understanding Metafile Graphics Metafile graphics combine raster and vector graphics and can have the characteristics of both file types. For example, if you scan a photograph (a bitmap image) and then add text or arrows (vector drawings), you create a metafile graphic. Although metafile graphics have the features of both bitmap and vector files, they share the limitations of both. For example, if you enlarge a metafile graphic, the area created with a bitmap loses some resolution, but the vector-formatted area remains sharp and clear. Understanding Graphics File Formats Graphics files are created and saved in a graphics editor, such as Microsoft Paint, Adobe Freehand MX, Adobe Photoshop, or Gnome GIMP. Some graphics editors, such as Freehand 10 384 Chapter 10 MX, work only with vector graphics, and some programs, such as Photoshop, work with both. Most graphics editors enable you to create and save files in one or more of the standard graphics file formats. Standard bitmap file formats include Graphics Interchange Format (.gif), Joint Photographic Experts Group (.jpg or .jpeg), Tagged Image File Format (.tif or .tiff), and Windows Bitmap (.bmp). Standard vector file formats include Hewlett Packard Graphics Language (.hpgl) and AutoCad (.dxf). Nonstandard graphics file formats include less common formats, such as Targa (.tga) and Raster Transfer Language (.rtl); proprietary formats, such as Photoshop (.psd), Illustrator (.ai), and Freehand (.fh20); newer formats, such as Scalable Vector Graphics (.svg); and formats for old or obsolete formats, such as Paintbrush (.pcx). Because you can open standard graphics files in most or all graphics programs, they are easier to work with in a computer forensics investigation. If you encounter files in nonstandard formats, you might need to rely on your investigative skills to identify the file as a graphics file, and then find the right tools for viewing it. To determine whether a file is a graphics file and to find a program for viewing a nonstandard graphics file, you can search the Web or consult a dictionary Web site. For example, suppose you find a file with a .tga extension during an investigation. None of the programs on your forensic workstation can open the file, and you suspect it could provide crucial evidence. To learn more about this file format, follow these steps: 1. Start your Web browser, and go to www.webopedia.com. 2. Type tga in the Enter a word for a definition text box, and then press Enter. Webopedia lists links to additional Web pages describing the .tga file format. 3. Click the Webopedia: Data Formats and Their File Extensions link to open a page with information about different file formats. 4. Scroll down until you find a definition of this format, and write it down. When you’re finished, exit your Web browser. Understanding Digital Camera File Formats Digital cameras’ popularity has had quite an impact on computer forensics because witnesses or suspects can create their own digital photos. As a computer forensics investigator, you might need to examine a digital photo created by a witness to an accident, for example. Crimes such as child pornography might involve hundreds of digital photos of alleged victims, and knowing how to analyze the data structures of graphics files can give you additional evidence for a case. In addition, knowing how digital photos are created and how they store unique information can contribute to your credibility when presenting evidence. Most, if not all, digital cameras produce digital photos in raw or EXIF format, described in the following sections. Examining the Raw File Format Referred to as a digital negative, the raw file format is typically used on many higher-end digital cameras. The camera performs no enhancement processing—hence the term “raw” for this format. Sensors in the digital camera simply record pixels on the camera’s memory card. The advantage of this format is that it maintains the best picture quality. Recognizing a Graphics File 385 From a computer forensics perspective, the biggest disadvantage of the raw file format is that it’s proprietary, and not all image viewers can display these formats. To view a raw graphics file, you might need to get the viewing and conversion software from the camera manufacturer. Each manufacturer has its own program with an algorithm to convert raw data to other standard formats, such as JPEG or TIF. The process of converting raw picture data to another format is referred to as demosaicing. Adobe (www.adobe.com/products/photoshop/cameraraw.html), the maker of Photoshop, is trying to get a standard for the raw format called Digital Negative (DNG). Examining the Exchangeable Image File Format Most digital cameras use the Exchangeable Image File (EXIF) format to store digital pictures. The Japanese Electronic Industry Development Association (JEIDA) developed it as a standard for storing metadata in JPEG and TIF files. When a digital picture is taken, information about the camera, such as model, make, and serial number, and settings, such as shutter speed, focal length, resolution, date, and time, are stored in the graphics file. Most digital cameras store graphics files as EXIF JPEG files. Because the EXIF format collects metadata, investigators can learn more about the type of digital camera and the environment in which pictures were taken. Viewing an EXIF JPEG file’s metadata requires special programs, such as Exif Reader (see www.snapfiles.com/get/ exifreader.html) or ProDiscover, which has a built-in EXIF viewer. Originally, JPEG and TIF formats were designed to store only digital picture data. EXIF is an enhancement of these formats that modifies the beginning of a JPEG or TIF file so that metadata can be inserted. In the similar pictures in Figure 10-1, the one on the left is an EXIF JPEG file, and the one on the right is a standard JPEG file. Figure 10-1 Similar EXIF and JPEG pictures Figure 10-2 shows the differences between file headers in EXIF and standard JPEG files. Sawtoothmt.jpg is an EXIF file, and Sawtoothmtn.jpg is a standard JPEG file. The first 160 (hexadecimal 0x9F) bytes are displayed for both files. All JPEG files, including EXIF, start from offset 0 (the first byte of a file) with hexadecimal FFD8. The current standard header for regular JPEG files is JPEG File Interchange Format 10 386 Chapter 10 Figure 10-2 Differences in EXIF and JPEG file header information (JFIF), which has the hexadecimal value FFE0 starting at offset 2. For EXIF JPEG files, the hexadecimal value starting at offset 2 is FFE1. In addition, the hexadecimal values at offset 6 specify the label name (refer to Figure 10-2). For all JPEG files, the ending hexadecimal marker, also known as the end of image (EOI), is FFD9 (see Figure 10-3). Figure 10-3 EOI marker FFD9 for all JPEG files With tools such as ProDiscover and Exif Reader, you can extract metadata as evidence for your case. As shown in Figure 10-4, the camera’s make and model are Minolta Dimage 2330 Zoom, and the picture was taken on August 12, 2002, at 9:16 p.m. You might have noticed in Figure 10-1 that there’s a lot of sunlight in the photos, but the metadata shows the time of day as after 9:00 p.m. in August. As in any computer forensics investigation, determining date and time for a file is important. Getting this information might not be possible, however, for a variety of reasons, such as suspects losing cameras Understanding Data Compression 387 10 Figure 10-4 Exif Reader displaying metadata from an EXIF JPEG file after transferring photo files to their computers. You should list this type of evidence as subjective in your report because intentional and unintentional acts make date and time difficult to confirm. For example, suspects could alter a camera’s clock intentionally so that an incorrect date and time are recorded when a picture is taken. An unintentional act could be the battery or camera’s electronics failing, for example, which causes an incorrect date and time to be recorded. When you’re dealing with date and time values in EXIF metadata, always look for corroborating information, such as where the picture was taken, to help support what you find in metadata. Understanding Data Compression Most graphics file formats, including GIF and JPEG, compress data to save disk space and reduce the file’s transmission time. Other formats, such as BMP, rarely compress data or do so inefficiently. In this case, you can use compression tools to compact data and reduce file size. Data compression is the process of coding data from a larger form to a smaller form. Graphics files and most compression tools use one of two data compression schemes: lossless 388 Chapter 10 or lossy. You need to understand how compression schemes work to know what happens when an image is altered. Lossless and Lossy Compression This section describes how lossless and lossy compression work, explains their advantages and disadvantages, and discusses what they mean in terms of computer forensics. Lossless compression techniques reduce file size without removing data. When you uncompress a file that uses lossless compression, you restore all its information. GIF and Portable Network Graphics (PNG) file formats reduce file size with lossless compression, which saves file space by using mathematical formulas to represent data in a file. These formulas generally use one of two algorithms: Huffman or Lempel-Ziv-Welch (LZW) coding. Each algorithm uses a code to represent redundant bits of data. For example, if a graphics file contains a large red area, instead of having to store 200 red bytes, the algorithm can set one byte to red and set another byte to specify 200 red bytes. Therefore, only 2 bytes are used. Lossy compression is much different because it compresses data by permanently discarding bits of information in the file. Some discarded bits are redundant, but others are not. When you uncompress a graphics file that uses lossy compression, you lose information, although most people don’t notice the difference unless they print the image on a high-resolution printer or increase the image size. In either case, the removed bits of information reduce image quality. The JPEG format is one that uses lossy compression. If you open a JPEG file in a graphics program, for example, and save it as a JPEG file with a different name, lossy compression is reapplied automatically, which removes more bits of data and, therefore, reduces image quality. If you simply rename a file by using Windows Explorer or the command line, however, the file doesn’t lose any more data. Another form of lossy compression, vector quantization (VQ), uses complex algorithms to determine what data to discard based on vectors in the graphics file. In simple terms, VQ discards bits in much the same way rounding off decimal values discards numbers. Some popular lossless compression utilities include WinZip, PKZip, StuffIt, and FreeZip. Lzip is a lossy compression utility. You use compression tools to compact folders and files for data storage and transmission. Remember that the difference between lossless and lossy compression is the way data is represented after it has been uncompressed. Lossless compression produces an exact replica of the original data after it has been uncompressed, whereas lossy compression typically produces an altered replica of the data. Locating and Recovering Graphics Files In a computer forensics investigation involving graphics files, you need to locate and recover all graphics files on the suspect drive and determine which ones are pertinent to your case. Because images aren’t always stored in standard graphics file formats, you should examine all files that your computer forensics tools find, even if they aren’t identified as graphics files. Some OSs have built-in tools for recovering graphics files, but they are time consuming, and the results are difficult to verify. Instead, you can use computer forensics tools dedicated to analyzing graphics files. As you work with these tools and built-in OS tools, develop standard Locating and Recovering Graphics Files 389 procedures for your organization and continue to refine them so that other investigators can benefit from your experience. You should also follow standard procedures for each case to ensure that your analysis is thorough. As discussed earlier in “Examining the Exchangeable Image File Format,” you can use computer forensics tools to analyze images based on information in graphics files. Each graphics file contains a header with instructions for displaying the image; this header information helps you identify the file format. The header is complex and difficult to remember, however; instead of memorizing header information, you can compare a known good file header with that of a suspected file. For example, if you find an image that you suspect is a JPEG file but can’t display it with a bitmap graphics program, compare its file header with a known JPEG file header to determine whether the header has been altered. You could then use the information in the known JPEG file header to supply instructions for displaying the image. In other words, you use the known JPEG header information to create a baseline analysis. Before you can examine a graphics file header, often you need to reconstruct a fragmented graphics file. To do so, you need to identify the data patterns the graphics file uses. If part of the file header has been overwritten with other data, you might also need to repair the damaged header. By rebuilding the file header, you can then perform a forensics analysis on the graphics file. These techniques are described in the following sections. Identifying Graphics File Fragments If a graphics file is fragmented across areas on a disk, first you must recover all the fragments to re-create the file. Recovering file fragments is called carving, also known as salvaging outside North America. To carve a graphics file’s data from file slack space and free space, you should be familiar with the data patterns of known graphics file types. Many computer forensics programs, such as ProDiscover or FTK, can recognize these data patterns and carve the graphics files from slack and free space automatically, however. After you recover fragments of a graphics file, you restore them to continue your examination. You use ProDiscover Basic and Hex Workshop later in this chapter to copy known data patterns from files you recover, and then restore this information to view the graphics file. Repairing Damaged Headers When you’re examining recovered fragments from files in slack or free space, you might find data that appears to be a header for a common graphics file type. If you locate header data that’s partially overwritten, you must reconstruct the header to make it readable by comparing the hexadecimal values of known graphics file formats to the pattern of the file header you found. Each graphics file type has a unique header value. As you become familiar with these header values, you can spot data from partially overwritten headers in file slack or free space. For example, as mentioned earlier, a JPEG file has the hexadecimal header value FFD8, followed by the label JFIF for a standard JPEG or EXIF file at offset 6. Suppose you’re investigating a possible intellectual property theft by a contract employee of Exotic Mountain Tour Service (EMTS). EMTS has just finished an expensive marketing and customer service analysis with Superior Bicycles, LLC. Based on this analysis, EMTS plans to release advertising for its latest tour service with a joint product marketing campaign with Superior Bicycles. Unfortunately, EMTS suspects that a contract travel consultant, Bob 10 390 Chapter 10 Aspen, might have given sensitive marketing data to another bicycle competitor. EMTS is under a nondisclosure agreement with Superior Bicycles and must protect this advertising campaign material. An EMTS manager found a USB drive on the desk Bob Aspen was assigned to. Your task is to determine whether the drive contains proprietary EMTS or Superior Bicycles data. The EMTS manager also gives you some interesting information he gathered from the Web server administrator. EMTS filters all Web-based e-mail traffic traveling through its network and detects suspicious attachments. When a Web-based e-mail with attachments is received, the Web filter is triggered. The EMTS manager gives you two screen captures, shown in Figures 10-5 and 10-6, of partial e-mails intercepted by the Web filter that lead him to believe Bob Aspen might have engaged in questionable activities. Figure 10-5 First intercepted capture of an e-mail from Terry Sadler For this examination, you need to search for all possible places data might be hiding. To do this, in the next section you use ProDiscover’s cluster search function with hexadecimal search strings to look for known data. Searching for and Carving Data from Unallocated Space At this time, you have little information on what to look for on the USB drive Bob Aspen used. You need to ask some basic questions and make some assumptions based on available information to proceed in your search for information. In the first message from [email protected], you see that it’s addressed to [email protected], which matches the contract employee’s name, Bob Aspen. Next, you look at the date and time stamps in this message. The first is 4 Feb 2007 9:21 PM, and the Locating and Recovering Graphics Files 391 Figure 10-6 Second intercepted capture of an e-mail from [email protected] second, farther down, is a header from Jim Shu with a date and time stamp of February 5, 2007, 5:17 AM -08:00. Therefore, it seems that Jim Shu originally sent the message, which was then forwarded to the [email protected] account. Because the time stamp for Jim Shu is later than the time stamp for [email protected], Terry Sadler’s location might be in a different time zone, somewhere west of Jim Shu, or one of the two e-mail server’s time values is off because e-mail servers, not users, provide time stamps. In Chapter 12, you learn more about e-mail header information. Continuing with the first message, you note that Jim is telling Terry to have Bob alter the file extensions from .txt to .jpg, and the files are about new kayaks. The last line appears to be a previous response from [email protected] commenting that Bob (assuming it’s Bob Aspen) can’t receive this message. So far, you have the following facts: • Jim Shu’s e-mail refers to JPEG files. • Jim Shu’s attached JPEG files need to have the extension renamed from .txt to .jpg. • Jim Shu’s attachments might be photographs of new kayaks. • The e-mail account names in this message are [email protected], [email protected], and [email protected] Now examine the second e-mail, which contains the following pieces of information: • Jim Shu had a tour of the new kayak factory. • Another party might be interested in competing in manufacturing kayaks. • Jim Shu smuggled out JPEG photos he modified with a hexadecimal editor so that they wouldn’t be detected by any Web or e-mail filters. 10 392 Chapter 10 • Jim Shu provides specific instructions on how to reedit the digital photos and add the .jpeg extension so that they can be viewed. • Jim Shu thinks Bob Aspen is working at EMTS. • Jim Shu sent a copy (CC) to [email protected] With these collected facts and your knowledge of JPEG file structures, you can use the steps in the following sections to determine whether these allegations are true. Planning Your Examination In the second e-mail from Jim Shu to Terry Sadler, Jim states, “So to view them you have to re-edit each file to the proper JPEG header of offset 0x FF D8 FF E0 and offset 6 of 4A.” From this statement, you can assume that any kayak photographs on the USB drive contain unknown characters in the first four bytes and the sixth byte. Because this is all Jim Shu said about the JPEG files, you need to assume that the seventh, eighth, and ninth bytes have the original correct information for the JPEG file. In “Examining the Exchangeable Image File Format,” you learned the difference between a standard JFIF JPEG and an EXIF JPEG file: The JFIF format has 0x FFD8 FFE0 in the first four bytes, and the EXIF format has 0x FFD8 FFE1. In the sixth byte, the JPEG label is listed as JFIF or EXIF. In the second e-mail, Jim Shu mentions 0x FF D8 FF E0, which is a JFIF JPEG format. He also says to change the sixth byte to 0x 4A, which is the uppercase letter “J” in ASCII. Because the files might have been downloaded to the USB drive, Bob Aspen could have altered or deleted them, so you should be thorough in your examination and analysis. You need to search all sectors of the drive for deleted files, both allocated space (in case Bob didn’t modify the files) and unallocated space. In the next section, you use ProDiscover to search for and recover these JPEG files. Searching for and Recovering Digital Photograph Evidence In this section, you learn how to use ProDiscover to search for and extract (recover) possible evidence of JPEG files from the USB drive the EMTS manager gave you. The search string to use for this examination is “FIF.” Because it’s part of the label name of the JFIF JPEG format, you might have several false hits if the USB drive contains several other JPEG files. These false hits, referred to as false positives, require examining each search hit to verify whether it’s what you are looking for. It’s assumed you have already acquired an image of the USB drive, so the image file is provided on the book’s DVD. You should extract all files in the Chap10 folder on the book’s DVD to your C:\Work\Chap10\Chapter folder (referred to as “your work folder” in steps). Create this folder on your system first, if necessary. Remember that the work folder you create most likely has a different name from what’s shown in screenshots. To begin the examination, follow these steps to load the image file: 1. Start ProDiscover Basic (with the Run as administrator option if you’re using Windows Vista), and click the New Project toolbar button. In the New Project dialog box, type C10InChp for the project number and filename, and then click OK. Locating and Recovering Graphics Files 393 2. Click Action from the menu, point to Add, and click Image file. 3. In the Open dialog box, navigate to your work folder, click C10InChp.eve, and then click Open. If necessary, click Yes in the Auto Image Checksum message box. 4. To begin a search, click the Search toolbar button or click Action, Search from the menu to open the Search dialog box. 5. Click the Cluster Search tab, and then click the Case Sensitive check box. Under Search for the pattern(s), type FIF (see Figure 10-7). Under Select the Disk(s)/Image(s) you want to search in, click the C10InChp.eve file, and then click OK. 10 Figure 10-7 Searching clusters in ProDiscover 6. When the search is done, click the first search hit, 4CA(1226), to display the cluster’s content (see Figure 10-8). 394 Chapter 10 Figure 10-8 Completed cluster search for FIF 7. Double-click the highlighted row 4CA(1226) to display the cluster view shown in Figure 10-9. Figure 10-9 Viewing cluster use and location of search hit for 4CA(1226) Locating and Recovering Graphics Files 395 In Figure 10-10, the header for this JPEG file has been overwritten with zzzz. This unique header information might give you additional search values that could minimize false-positive hits in subsequent searches. Figure 10-10 Content of cluster 4CA(1226) 8. Next, you need to locate the file. Right-click cluster block 4CA(1226) and click Find File, and then click Yes in the warning message. 9. In the List of Clusters dialog box, click Show File (see Figure 10-11), and then click Close. Figure 10-11 Viewing all clusters used by the gametour2.exe file 10 396 Chapter 10 10. In the work area, right-click the gametour2.exe file (shown selected in Figure 10-12) and click Copy File. In the Save As dialog box, delete the original filename, type Recover1.jpg, and then click Save to save this file in your work folder. Figure 10-12 Mislabeled file that appears to be altered intentionally 11. Click File, Exit from the menu, and then click Yes to save this project in your work folder. The next section shows you how to rebuild header data from this recovered file by using Hex Workshop, although any hexadecimal editor has the capability to examine and repair damaged file headers. From a computer forensics view, this procedure can be considered corrupting the evidence, but knowing how to reconstruct data, as in the preceding example, is part of an investigator’s job. When you change data as part of the recovery and analysis process, make sure you document your steps as part of your reporting procedures. Your documentation should be detailed enough that other investigators could repeat the steps, which increases the credibility of your findings. When you’re rebuilding a corrupted evidence image file, create a new file and leave the original file in its initial corrupt condition. Rebuilding File Headers Before attempting to edit a graphics file you have recovered, try to open it with an image viewer, such as the default Microsoft tool. To test whether you can view the image, doubleclick the recovered file in its current location in Windows Explorer. If you can open and view Locating and Recovering Graphics Files 397 the image, you have recovered the graphics file successfully. If the image isn’t displayed, you have to inspect and correct the header values manually. If some of the data you recovered from the graphics file header is corrupt, you might need to recover more pieces of the file before you can view the image, as you’ll see in the next section. Because the deleted file you recovered in the previous activity, Recover1.jpg, was altered intentionally, when you attempt to open it, you might see an error message similar to the one in Figure 10-13. 10 Figure 10-13 Error message indicating a damaged or an altered graphics file If you can’t open a graphics file in an image viewer, the next step is to examine the file’s header data to see whether it matches the header in a good JPEG file. If the header doesn’t match, you must insert the correct hexadecimal values manually with a hexadecimal editor. To inspect a file with Hex Workshop, follow these steps: 1. Start Hex Workshop. Click File, Open from the menu. Navigate to your work folder, and then double-click Recover1.jpg. Figure 10-14 shows this file open in Hex Workshop. 2. At the top of the Hex Workshop window, note that the hexadecimal values starting at the first byte position (offset 0) are 7A 7A 7A 7A, and the sixth position (offset 6) is also 7A. Leave Hex Workshop open for the next set of steps. 398 Chapter 10 Figure 10-14 Recover1.jpg open in Hex Workshop As mentioned, a standard JFIF JPEG file has a header value of FF D8 FF E0 from offset 0 and the label name JFIF starting at offset 6. Using Hex Workshop, you can correct this file header manually by following these steps: 1. In the center pane, click to the left of the first 7A hexadecimal value. Then type FF D8 FF E0, which are the correct hexadecimal values for the first 4 bytes of a JPEG file. 2. In the right pane, click to the left of FIF, backspace to delete the z, and type J, as shown in Figure 10-15. Figure 10-15 Inserting correct hexadecimal values for a JPEG file Locating and Recovering Graphics Files 399 In Hex Workshop, when you type a keyboard character in the right pane, the corresponding hexadecimal value appears in the center pane. So, for example, when you type J in the right pane, the hexadecimal value 4A appears in the center pane. 3. Click File, Save As from the menu. In the Save As dialog box, navigate to your work folder, type Fixed1.jpg as the filename, and then click Save. Exit Hex Workshop. Every two hexadecimal values you entered in the previous steps are equivalent to one ASCII character. For example, an uppercase “A” has the hexadecimal value 41, and a lowercase “a” has the hexadecimal value 61. Most disk editors have a reference chart for converting hexadecimal values to ASCII characters, such as Hex Workshop’s in Figure 10-16. 10 Figure 10-16 ASCII equivalents of hexadecimal values After you repair a graphics file header, you can test the updated file by opening it in an image viewer, such as Windows Photo Gallery, IrfanView, ThumbsPlus, Quick View, or ACDSee. To test the repaired JPEG file, follow these steps: 1. In Windows Explorer, navigate to your work folder and double-click Fixed1.jpg. The file opens in your default image viewer, such as Windows Photo Gallery (see Figure 10-17). 2. Verify that you have recovered the file correctly, and then exit the image viewer. The process of repairing file headers isn’t limited to JPEG files. You can apply the same technique to any file for which you can determine the header value, including Microsoft Word, Excel, and PowerPoint documents and other image formats. You need to know only the correct header format for the type of file you’re attempting to repair. Reconstructing File Fragments You might occasionally encounter corrupt data that prevents you from recovering data fragments for files. Whether the data corruption is accidental or intentional, you need to know how to examine a suspect drive and extract possible data fragments to reconstruct files for evidentiary purposes. In this section, you learn how to locate noncontiguous clusters from a deleted file. Modern computer forensics tools can typically follow the links between clusters for FAT and NTFS file systems. However, sometimes the pointer information in a FAT or an NTFS MFT file doesn’t list this information. 400 Chapter 10 Figure 10-17 Fixed1.jpg open in Windows Photo Gallery This following activity shows you how to recover a graphics file with a corrupt header that’s fragmented on the suspect drive. To perform this data-carving task, you need to locate the starting and ending clusters for each fragmented group of clusters in the corrupted file. Here’s an overview of the procedure: 1. Locate and export all clusters of the fragmented file. 2. Determine the starting and ending cluster numbers for each fragmented group of clusters. 3. Copy each fragmented group of clusters in their correct sequence to a recovery file. 4. Rebuild the corrupted file’s header to make it readable in a graphics viewer. Use the project you created previously, C10InChp, to analyze the fragmentation: 1. Start ProDiscover Basic (with the Run as administrator option in Windows Vista). Click File, Open Project from the menu, navigate to your work folder, click the C10InChp.dft file, and then click Open. 2. In the tree view, click Cluster Search Results, and then in the work area, click AE3 (2787), as shown in Figure 10-18. Locating and Recovering Graphics Files 401 Figure 10-18 Cluster search results for the AE3(2787) cluster 3. Right-click the cluster row AE3(2787) and click Find File. 4. In the List of Clusters dialog box, click Copy to Clipboard. Start Notepad, paste the cluster into a new document, and save the file as AE3-carve.txt in your work folder. Leave Notepad open for the following steps. 5. In ProDiscover’s List of Clusters dialog box, click Close. 6. In the tree view, click to expand Cluster View, if necessary, click to expand Images, and then click the C10InChp.eve image file, as shown in Figure 10-19. 7. Examine the AE3-carve.txt file in Notepad to determine the clusters that are grouped together—the range for each cluster group. For example, locate the first cluster number, AE3, and count downward until you locate a cluster number that’s not sequential. Make note of the last contiguous cluster number before the change to determine the first cluster group for this fragmented file. Continue through the list of cluster numbers to determine all fragments. The following list shows the cluster groups you should find: • Fragment range 1—AE3 to B3F • Fragment range 2—1F5 to 248 • Fragment range 3—3EB to 425 • Fragment range 4—16A to 1A1 • Fragment range 5—957 to 98C • Fragment range 6—25 to 2C 10 402 Chapter 10 Figure 10-19 Cluster view of C10InChp.eve The first fragment starts at hexadecimal AE3 (decimal 2787) and continues to hexadecimal B3F. The next fragment starts at 1F5 and continues to 248, and so on until the last segment of fragmented clusters. This file is very fragmented. 8. In ProDiscover’s tree view, click Cluster View, Images, and the C10InChp.eve file, if necessary. In the work area’s Sector text box, type AE3 (see Figure 10-20) and click Go. To view all cluster columns in the work area, as shown in Figures 10-20 and 10-21, you need to maximize ProDiscover Basic’s view and increase the work area’s size. Drag its left border to the left, into the tree view, until you can see all 30 hexadecimal columns, and then release the mouse button. 9. In the work area, click to select all blocks from AE3 to B3F (see Figure 10-21). 10. Right-click the highlighted blocks (sectors) in the work area and click Select. In the Add Comment dialog box, click the Apply to all items check box. In the Investigator comments text box, type Fragment 1 to recover, and then click OK. 11. Repeat Steps 8 through 10 to select the remaining fragmented blocks for these sectors: 1F5 to 248, 3EB to 425, 16A to 1A1, 957 to 98C, and 25 to 2C. In the Add Comment dialog box, increase the comment’s fragment number by 1 for each block: Fragment 2 to recover, Fragment 3 to recover, and so on. 12. After all sectors have been selected, click Tools, Copy Selected Clusters from the menu. Locating and Recovering Graphics Files 403 Figure 10-20 Cluster view of sector AE3 10 Figure 10-21 Selected blocks from sector AE3 to B3F 13. In the Recover Clusters dialog box, click the Recover all clusters to a single file option button and the Recover Binary check box (see Figure 10-22). Click Browse, navigate to and click your work folder, and then click OK. 14. Exit ProDiscover Basic, saving this project in your work folder if prompted. Exit Notepad, saving the file if prompted. The next step would be rebuilding the header of this recovered file, as you did in a previous activity. When you copy the selected data with ProDiscover’s Recover Clusters function, a file named C10InChp-0000-0353.txt is created. ProDiscover adds a .txt extension automatically on all copied sectors or clusters the Recover Clusters function exports. 404 Chapter 10 Figure 10-22 Copying all selected clusters or sectors to a file In this recovered file, sector AE3 contains “FIF” preceded by the altered header you found at sector 4CA. To view and rebuild C10InChp-0000-0353.txt, you would use the techniques described previously in “Rebuilding File Headers.” Remember to save the updated recovered data with a .jpg extension. Figure 10-23 shows the results. Figure 10-23 Recovered data from starting sector AE3 after Hex Workshop corrects the header Identifying Unknown File Formats 405 In addition to the natural occurrence of file fragmentation, sometimes suspects intentionally corrupt cluster links in a disk’s FAT. Anyone can use a disk-editing tool, such as Norton DiskEdit, to access the FAT and mark specific clusters as bad by typing the letter “B” at the cluster. After you mark a cluster as bad, it’s displayed with a 0 value in a disk editor. As Figure 10-24 shows, cluster position 156 has a 0 value, indicating that this cluster doesn’t link to any other clusters on the disk. The OS ignores clusters marked in this manner and doesn’t use them, which makes it possible to hide data in these clusters. Figure 10-24 Bad cluster appearing as 0 in Norton DiskEdit Identifying Unknown File Formats With the continuing changes in technology and computer graphics, eventually you’ll encounter graphics file formats you’re not familiar with. In addition, suspects might use older computer systems with programs that create files in uncommon or obsolete file formats. Therefore, you must research both old and new file types. Knowing the purpose of each format and how it stores data is part of the investigation process. The Internet is the best source for learning more about file formats and their extensions. You have already used the Webopedia site to research the TGA file format. You can also use a search engine to search for “file type” or “file format” and find the latest list of Web sites with information on file extensions. If you still can’t find a specific file extension, try refining your search by entering the file extension along with the words “file format” in a search engine. One nonstandard graphics file format is XIF. To search for information on this file format, follow these steps: 1. Start your Web browser, and go to www.google.com. 2. Type XIF file format in the text box and press Enter. 3. Click a few links in the search results to learn more about this file format. When you’re finished, exit your Web browser. 10 406 Chapter 10 Nuance PaperPort is a scanning program that produces images in the XIF format, which is derived from the TIF file format. Older versions of PaperPort have a free viewer utility for XIF files; you can also use Windows 2000 Kodak Imaging for Windows. For more information about XIF files, go to www.scantips.com/pagis1.html. The following sites provide information to help you analyze file formats. Keep in mind that information on the Web changes frequently; use a search engine to find graphics file information if you can’t access these Web sites: • www.digitek-asi.com/file_formats.html • www.wotsit.org • www.martinreddy.net/gfx/ Analyzing Graphics File Headers You should analyze graphics file headers when you find new or unique file types that computer forensics tools don’t recognize. The simplest way to access a file header is to use a hexadecimal editor, such as Hex Workshop. You can then record the hexadecimal values in the header and use them to define a file type. For example, suppose you encounter an XIF file, which you learned about in the previous section. Because this format is so old, not much information on it is available. If you need to look for hidden or deleted XIF files, you must build your own header search string. To do this, you need a hexadecimal editor, such as Hex Workshop. To see the differences between XIF and TIF, viewing and comparing header values for these file formats is good practice. TIF is a well-established file format for transmitting faxes and for use in printed publications. All TIF files start at offset 0 with hexadecimal 49 49 2A. These hexadecimal values translate to the letters “II” in ASCII. Figure 10-25 shows the Sawtooth_050.tif file open in Hex Workshop. Figure 10-25 A TIF file open in Hex Workshop Identifying Unknown File Formats 407 The first 3 bytes of an XIF file are the same as a TIF file, followed by other hexadecimal values that distinguish it from a TIF file (see Figure 10-26). As you can see, the XIF header starts with hexadecimal 49 49 2A and has an offset of 4 bytes of 5C 01 00 00 20 65 58 74 65 6E 64 65 64 20 03. (Some values have been cut off in Figure 10-26 to conserve space.) With this information, you can configure your computer forensics tool to detect an XIF file header. Figure 10-26 An XIF file open in Hex Workshop Tools for Viewing Images Throughout this chapter, you have been learning about recognizing file formats, using compression techniques, salvaging header information, recovering graphics files, and saving your modifications. After you recover a graphics file, you can use an image viewer to open and view it. Several hundred image viewers are available that can read many graphics file formats, although no one viewer program can read every file format. Therefore, having many different viewer programs for investigations is best. Many popular viewer utilities are freeware or shareware programs, such as ThumbsPlus, ACDSee, Quick View, and IrfanView, that can be used to view a wide range of graphics file formats. Most GUI computer forensics tools, such as ProDiscover, EnCase, FTK, X-Ways Forensics, and ILook, include image viewers that display only common image formats, especially GIF and JPEG, which are often found in Internet-related investigations. However, for less common file formats, such as PCX, integrated viewers often simply identify the data as a graphics file or might not recognize the data at all. Being unable to view all formats can prevent you from finding critical evidence for a case. Be sure that you analyze, identify, and inspect every unknown file on a drive. With many computer forensics tools, you can open files with external viewers. 10 408 Chapter 10 Understanding Steganography in Graphics Files When you open some graphics files in an image viewer, they might not seem to contain information related to your investigation. However, someone might have hidden information inside the image by using a data-hiding technique called steganography (introduced in Chapter 9), which uses a host file to cover the contents of a secret message. Steganography has been used since ancient times. Greek rulers used this technique to send covert messages to diplomats and troops via messengers. To protect the message’s privacy, rulers shaved their messengers’ heads and tattooed messages on their scalps. After their hair grew enough to cover the message, the messengers left for their destinations, where they shaved their heads so that recipients could read the message. This method was a clever way to send and retrieve encrypted information, but it was inefficient because the messengers’ hair took a long time to grow back, and only a limited amount of space was available to write messages. However, it enabled the Greeks to send secret messages until their enemies discovered this early form of steganography and began intercepting messengers. Contemporary steganography is also inefficient because a graphics file can hide only a certain amount of information before its size and structure change. However, it does allow someone to send covert information to a recipient, unless someone else detects the hidden data. The two major forms of steganography are insertion and substitution. Insertion places data from the secret file into the host file. When you view the host file in its associated program, the inserted data is hidden unless you analyze the data structure carefully. For example, if you create a Web page with HTML, you can display images and text in a Web browser without revealing the HTML code. Figure 10-27 shows a typical Web page as it was Figure 10-27 A simple Web page displayed in a Web browser Identifying Unknown File Formats 409 intended to be viewed in a Web browser. This Web page contains hidden text, which is shown in Figure 10-28 along with the source HTML code. To detect hidden inserted text, you need to compare what the file displays and what the file contains. Depending on your skill level, this process can be difficult and time consuming. Figure 10-28 The HTML code reveals hidden text The second type of steganography, substitution, replaces bits of the host file with other bits of data. With a bitmap file, for example, you could replace bits used for pixels and colors with hidden data. To avoid detection, you substitute only those bits that result in the least amount of change. For example, if you use an 8-bit graphics file, each pixel is represented by 8 bits of data containing information about the color each pixel displays onscreen. The bits are prioritized from left to right, such as 11101100. The first bit on the left is the most significant bit (MSB), and the last bit on the right is the least significant bit (LSB). As the names suggest, changing the MSB affects the pixel display more than changing the LSB does. Furthermore, you can usually change only the last two LSBs in an image without producing a noticeable change in the shade of color the pixel displays. To detect a change to the last two LSBs in a graphics file, you need to use a steganalysis tool, which is software designed to identify steganography techniques. For example, if your secret message is converted to binary form to equal 01101100 and you want to embed this secret message into a picture, you alter the last 2 bits of four pixels. You break the binary form into sections of two, as in 01 10 11 00, and insert the bits into the last 2 bits of each pixel, as shown in Table 10-1. Table 10-1 Bit breakdown of a secret message Original pixel 1010 1010 Altered pixel 1010 1001 1001 1101 1001 1110 1111 0000 1111 0011 0011 1111 0011 1100 10 410 Chapter 10 The sequence of 2 bits is substituted for the last 2 bits of the pixel. This bit substitution can’t be detected by the human eye, which can see only about 6 bits of color. Figure 10-29 shows the original picture, a simple line drawing, on the left and the altered image on the right. Figure 10-29 Original and altered images The altered image contains the hidden picture shown in Figure 10-30. Figure 10-30 Hidden picture in the altered image Whether insertion or substitution is used, graphics files are usually chosen for steganography because they contain enough bits to manipulate for hiding data. Therefore, you should always inspect graphics files for steganography evidence, especially if your suspect is technically savvy. Steganography can be used with file formats other than graphics files, such as MPEG and AVI files. Understanding Copyright Issues with Graphics 411 Using Steganalysis Tools You can use several different steganalysis tools (also called “steg tools”) to detect, decode, and record hidden data, even in files that have been renamed to protect their contents. If you suspect steganography has been used, search the suspect device for evidence of installed steganalysis tools. A steganalysis tool can also detect variations of an image. If a graphics file has been renamed, a steganalysis tool can identify the file format from the file header and indicate whether the file contains an image. Although steganalysis tools can help identify hidden data, steganography is generally difficult to detect. In fact, if steganography is done correctly, in most cases you can’t detect the hidden data unless you can compare the altered file with the original file. Check to see whether the file size, image quality, or file extensions have changed. If so, you might be dealing with a steganography image. As an example of the complexity of detecting steganography, Niels Provos and Peter Honeyman at the University of Michigan conducted a study of more than two million images used in eBay auctions to see whether hidden data might have been placed in photos (see www.citi.umich.edu/techreports/reports/ citi-tr-01-11.pdf). They were unable to determine whether any graphics files contained hidden messages. Steganography and steganalysis tools change as rapidly as some OSs. Current steg tools include Stegowatch, Outguess, StegDetect, and S-Tools. For a list of other steg tools, you can do an Internet search on “steganography” or “steganalysis.” Steganalysis tools usually compare a suspect file to a known good version or a known bad version of the graphics file. Some recent tools can detect steganography without a known good or bad file, however. Because graphics files are binary, these tools perform complex mathematical calculations to verify a file’s authenticity by checking file size and palette color. Other tools compare the hash value of a known good or bad file to the suspect file to determine whether steganography was used. You can also use steganalysis tools to determine which sectors of a graphics file hide data. Keep in mind that this investigation task can be time consuming. Your first obstacle is obtaining the original graphics file to compare to the suspected steganography file. In some cases, you can find the original file on the suspect’s computer or recover it, if it was deleted. If the filename has been changed, you might need to view each graphics file you recover to try to find a match. If you can’t find the original file, you can still analyze the suspect file by using a steganalysis tool to detect hidden data. In the Hands-On Projects at the end of this chapter, you analyze a steganography file. Understanding Copyright Issues with Graphics Steganography has also been used to protect copyrighted material by inserting digital watermarks into a file. When working with graphics files, computer investigators need to be aware of copyright laws, especially in the corporate environment, where they often work closely with the legal department to guard against copyright violations. Investigators might also need to 10 412 Chapter 10 determine whether a photo is from a known copyrighted source, such as a news photo being posted on a Web page without permission. The U.S. Copyright Office Web site defines precisely how copyright laws pertain to graphics (see www.copyright.gov for information on the 1976 Copyright Act). Copyright laws as they pertain to the Internet, however, aren’t as clear. For example, a server in another country might host a Web site, which could mean it’s regulated by copyright laws in that country. Because each country has its own copyright laws, enforcement can be difficult. Contrary to what some might believe, there’s no international copyright law. The U.S. Copyright Office identifies what can and can’t be covered under copyright law in the United States: Copyright protects “original works of authorship” that are fixed in a tangible form of expression. The fixation need not be directly perceptible so long as it may be communicated with the aid of a machine or device. Copyrightable works include the following categories: 1. literary works; 2. musical works, including any accompanying words; 3. dramatic works, including any accompanying music; 4. pantomimes and choreographic works; 5. pictorial, graphic, and sculptural works; 6. motion pictures and other audiovisual works; 7. sound recordings; 8. architectural works. These categories should be viewed broadly. For example, computer programs and most “compilations” may be registered as “literary works”; maps and architectural plans may be registered as “pictorial, graphic, and sculptural works.” Anything that would ordinarily be copyrighted through noncomputer means and is now being created on digital media is considered to be copyrighted, as long as the process for obtaining a copyright has been followed. Digital watermarks can be visible or imperceptible in media such as digital photos or audio files. Visible watermarks are usually an image, such as the copyright symbol or a company logo, layered on top of a photo. Imperceptible watermarks don’t change the appearance or sound quality of a copyrighted file. Methods used for imperceptible watermarks sometimes involve modifying a file’s LSBs into a unique pattern. Chapter Summary ■ A graphics file contains an image, such as a digital photo, line art, a three-dimensional image, or a scanned replica of a printed picture. A graphics program creates and saves one of three types of graphics files: bitmap, vector, and metafile. Bitmap images are collections of dots, or pixels, that form an image. Vector graphics are mathematical instructions that define lines, curves, text, and geometric shapes. Metafile graphics are combinations of bitmap and vector images. Chapter Summary 413 ■ When you use a graphics editor or an image viewer, you can open a file in one of many graphics file formats. Each format has different qualities, including the amount of color and compression it uses. If you open a graphics file in a program that supports multiple file formats, you can save the file in a different file format. However, converting graphics files this way can change image quality. ■ Bitmap images store graphics information as grids of pixels (short for “picture elements”). The quality of a bitmap image displayed onscreen is governed by resolution, which determines the amount of detail displayed. Vector graphics, unlike bitmap and raster files, use lines instead of dots. A vector graphic stores only the calculations for drawing lines and shapes; a graphics program converts these calculations into images. You can enlarge a vector graphic without affecting image quality. Metafile graphics combine bitmap and vector graphics and can have the characteristics of both image types. ■ Most graphics editors enable you to create files in one or more of the standard graphics file formats, such as Graphic Interchange Format (.gif), Joint Photographic Experts Group (.jpeg), Windows Bitmap (.bmp), or Encapsulated Postscript (.eps). Nonstandard graphics file formats include less common formats, such as Targa (.tga) and Raster Transfer Language (.rtl); proprietary formats, such as Photoshop (.psd); newer formats, such as Scalable Vector Graphics (.svg); and old or obsolete formats, such as Paintbrush (.pcx). ■ Most graphics file formats, including .gif and .jpeg, compress data to save disk space and reduce transmission time. Other formats, such as .bmp, rarely compress data or do so inefficiently. You can use compression tools to compact data and reduce file size. Lossless compression saves file space by using mathematical formulas to represent data in a file. Lossy compression compresses data by permanently discarding bits of information in the file. ■ Digital camera photos are typically in raw and EXIF JPEG formats. The raw format is the proprietary format of the camera’s manufacturer. The EXIF format is different from the standard JFIF JPEG format because it contains metadata about the camera and picture, such as shutter speed and date and time a picture was taken. ■ In a computer forensics investigation involving graphics files, you need to locate and recover all graphics files on a drive and determine which ones are pertinent to your case. Because these files aren’t always stored in standard graphics file formats, you should examine all files your computer forensics tools find, even if they aren’t identified as graphics files. A graphics file contains a header with instructions for displaying the image. Each type of graphics file has its own header that helps you identify the file format. Because the header is complex and difficult to remember, you can compare a known good file header with that of a suspect file. ■ When you’re examining recovered data remnants from files in slack or free space, you might find data that appears to be a header for a common graphics file type. If you locate header data that’s partially overwritten, you must reconstruct the header to make it readable again by comparing the hexadecimal values of known graphics file formats to the pattern of the file header you found. After you identify fragmented data, you can use a computer forensics tool to recover the fragmented file. 10 414 Chapter 10 ■ If you can’t open a graphics file in an image viewer, the next step is to examine the file header to see whether it matches the header in a known good file. If the header doesn’t match, you must insert the correct hexadecimal values manually with a hex editor. ■ The Internet is the best source for learning more about file formats and their extensions. You can search for “file type” or “file format” and find a list of Web sites with information on file extensions. ■ You should analyze graphics file headers when you find new or unique file types that computer forensics tools don’t recognize. The simplest way to do this is with a hex editor. You can record the hexadecimal values in the header for future reference. ■ Many popular viewer utilities are freeware or shareware and enable you to view a wide range of graphics file formats. Most GUI forensics tools, such as ProDiscover, EnCase, FTK, X-Ways Forensics, and ILook, include image viewers that display common image formats, especially GIF and JPEG. ■ Steganography is a method of hiding data by using a host file to cover the contents of a secret message. The two major techniques are insertion and substitution. Insertion places data from the secret file into the host file. When you view the host file in its associated program, the inserted data is hidden unless you analyze the data structure. Substitution replaces bits of the host file with other bits of data. ■ Steganalysis tools can detect hidden data in graphics files, even in files that have been renamed to protect their contents. If the file has been renamed, steganalysis tools can use the file header to identify the file format and indicate whether the file contains an image. Steganalysis tools can also detect variations in a graphics file. Key Terms bitmap images Collections of dots, or pixels, in a grid format that form a graphic. carving The process of recovering file fragments that are scattered across a disk. See also salvaging. data compression The process of coding data from a larger form to a smaller form. demosaicing The process of converting raw picture data to another format, such as JPEG or TIFF. Exchangeable Image File (EXIF) A file format the Japanese Electronic Industry Development Association (JEIDA) developed as a standard for storing metadata in JPEG and TIFF files. false positives The results of keyword searches that contain the correct match but aren’t relevant to the investigation. lossless compression A compression method in which no data is lost. With this type of compression, a large file can be compressed to take up less space and then uncompressed without any loss of information. lossy compression A compression method that permanently discards bits of information in a file. The removed bits of information reduce image quality. metafile graphics Graphics files that are combinations of bitmap and vector images. Review Questions 415 nonstandard graphics file formats Less common graphics file formats, including proprietary formats, newer formats, formats that most image viewers don’t recognize, and old or obsolete formats. pixels Small dots used to create images; the term comes from “picture element.” raster images Collections of pixels stored in rows rather than a grid, as with bitmap images, to make graphics easier to print; usually created when a vector graphic is converted to a bitmap image. rasterize The process of converting a bitmap file to a raster file for printing. raw file format A file format typically found on higher-end digital cameras; the camera performs no enhancement processing—hence the term “raw.” This format maintains the best picture quality, but because it’s a proprietary format, not all image viewers can display it. resolution The density of pixels displayed onscreen, which governs image quality. salvaging Another term for carving, used outside North America. See carving. standard graphics file formats Common graphics file formats that most graphics programs and image viewers can open. steganalysis tool A program designed to detect and decode steganography techniques. vector graphics Graphics based on mathematical instructions to form lines, curves, text, and other geometrical shapes. vector quantization (VQ) A form of compression that uses an algorithm similar to rounding off decimal values to eliminate unnecessary bits of data. Review Questions 1. Graphics files stored on a computer can’t be recovered after they are deleted. True or False? 2. When you carve a graphics file, recovering the image depends on which of the following skills? a. Recovering the image from a tape backup b. Recognizing the pattern of the data content c. Recognizing the pattern of the file header content d. Recognizing the pattern of a corrupt file 3. Explain how to identify an unknown graphics file format that your computer forensics tool doesn’t recognize. 4. What type of compression uses an algorithm that allows viewing the graphics file without losing any portion of the data? 5. When investigating graphics files, you should convert them into one standard format. True or False? 10 416 Chapter 10 6. Digital pictures use data compression to accomplish which of the following goals? (Choose all that apply.) a. Save space on a hard drive. b. Provide a crisp and clear image. c. Eliminate redundant data. d. Produce a file that can be e-mailed or posted on the Internet. 7. Salvaging a file is also known in North America by which of the following terms? a. Data recovery b. Scavenging c. Recycle Bin d. Carving 8. In JPEG files, what’s the starting offset position for the JFIF label? a. Offset 0 b. Offset 2 c. Offset 6 d. Offset 4 9. Each type of graphics file has a unique header containing information that distinguishes it from other types of graphics files. True or False? 10. Copyright laws don’t apply to Web sites. True or False? 11. When viewing a file header, you need to include hexadecimal information to view the image. True or False? 12. When recovering a file with ProDiscover, your first objective is to recover cluster values. True or False? 13. Bitmap (.bmp) files use which of the following types of compression? a. WinZip b. Lossy c. Lzip d. Lossless 14. A JPEG file uses which type of compression? a. WinZip b. Lossy c. Lzip d. Lossless 15. Only one file format can compress graphics files. True or False? 16. A JPEG file is an example of a vector graphic. True or False? Hands-On Projects 417 17. JPEG and TIF files: a. Have identical values for the first 2 bytes of their file headers b. Have different values for the first 2 bytes of their file headers c. Differ from other graphics files because their file headers contain more bits d. Differ from other graphics files because their file headers contain fewer bits 18. What methods do steganography programs use to hide data in graphics files? (Choose all that apply.) a. Insertion b. Substitution c. Masking d. Carving 19. Some clues left on a drive that might indicate steganography include which of the following? a. Multiple copies of a graphics file b. Graphics files with the same name but different file sizes c. S-Tools and Stegowatch in the suspect’s All Programs list d. All of the above 20. What methods are used for digital watermarking? (Choose all that apply.) a. Implanted subroutines that link to a central Web server automatically when the watermarked file is accessed b. Invisible modification of the LSBs in the file c. Layering visible symbols on top of the image d. Using a hex editor to alter the image data Hands-On Projects If necessary, extract all data files in the Chap10\Projects folder on the book’s DVD to the C:\Work\Chap10\Projects folder on your system. (You might need to create this folder on your system before starting the projects; it’s referred to as “your work folder” in steps.) Hands-On Project 10-1 In this project, you use ProDiscover Basic to locate and extract JPEG files with altered extensions. Some of these files are embedded in files with non-JPEG extensions. Find the C10frag.eve file in your work folder, and then follow these steps: 1. Start ProDiscover Basic (with the Run as administrator option if you’re using Vista) and begin a new project. In the New Project dialog box, type C10frag in the Project Number and Project File Name text boxes, and then click OK. 10 418 Chapter 10 2. In the tree view, click to expand Add, and then click Image File. In the Open dialog box, navigate to your work folder and click C10frag.eve. Click Open, and then click Yes, if necessary, in the Auto Image Checksum message box. 3. Click the Search toolbar button. In the Search dialog box, click the Content Search tab. Under Search for the pattern(s), type JFIF, and under Select the Disk(s)/Image(s) you want to search in, click C10frag.eve. Click OK. 4. Click each file in the work area’s search results that doesn’t have a .jpg extension, and in the data area, scroll through each file to find any occurrences of a JFIF label. Click the check box next to each file with a JFIF label. When the Add Comment dialog box opens, type Recovered hidden .jpg file, click the Apply to all items check box, and then click OK. 5. In the tree view, click Report, and then click File, Print Report from the menu. You can also save your report by clicking the Export toolbar button, and in the Export dialog box’s File name text box, type C10Prj01.rtf, and then click OK. 6. Exit ProDiscover Basic, saving your project when prompted. Hands-On Project 10-2 In this project, you continue the search for files Bob Aspen downloaded. In the in-chapter activity, you recovered three files containing “zzzz” for the first 4 bytes of altered JPEG files. These altered files had different extensions to hide the fact that they’re graphics files. Find the C10carve.eve file in your work folder. This image file is a new acquisition of another USB drive the EMTS manager retrieved. He wants to know whether any similar files on this drive match the files you recovered from the first USB drive. Because you know that the files you recovered earlier have zzzz for the first 4 bytes, you can use it as your search string to see whether similar files exist on this USB drive. 1. Start ProDiscover Basic (with the Run as administrator option if you’re using Vista) and begin a new project. In the New Project dialog box, type C10carve for the project number and project filename, and then click OK. 2. In the tree view, click to expand Add, and then click Image File. In the Open dialog box, navigate to your work folder and click C10carve.eve. Click Open, and then click Yes, if necessary, in the Auto Image Checksum message box. 3. Next, click the Search toolbar button. In the Search dialog box, click the Content Search tab, and then click the ASCII option button and the Case Sensitive check box. Under Search for the pattern(s), type zzzz, and under Select the Disk(s)/Image(s) you want to search in, click C10carve.eve. Click OK. 4. Click each file in the work area’s search results to display it in the data area. If the file contains zzzz at the beginning of the sector, click the Select Hands-On Projects 419 check box next to it. In the Add Comment dialog box, type Similar file located on first USB drive, click the Apply to all items check box, and then click OK. 5. In the work area, click the Add to Report button. 6. Double-click the gametour5.txt file. In the work area, click the File Name column heading to sort all files in this pane. Scroll through the list of files and click the Select check box for the gametour1.txt, gametour2.txt, gametour3.txt, gametour4.txt, and gametour6.txt files. When the Add Comment dialog box opens, type Additional similar files on USB drive, and then click OK. Repeat this step for each gametour file you find. 7. Right-click the gametour1.txt file and click Copy All Selected Files. In the Choose Destination dialog box, click Browse, navigate to and click your work folder, and then click OK. 8. To complete your examination, in the tree view, click Report, and then click File, Print Report from the menu. You can also save your report by clicking the Export toolbar button, and in the Export dialog box’s File name text box, type C10Prj02.rtf. Then click OK. 9. Save the project and exit ProDiscover Basic. Hands-On Project 10-3 In this project, you use IrfanView to open graphics files and save them in a compressed graphics format different from the original format. You should note any changes in image quality after converting files to a different format. Download IrfanView from www.irfanview.com and install it, and then follow these steps: 1. Start IrfanView. 2. Click File, Open from the menu. In the Open dialog box, navigate to your work folder, and then double-click Spider.bmp to open the file. 3. Click File, Save as from the menu. Change the file type to JPG and save the file as Spider.jpg in the same location. 4. Save Spider.jpg as Spider2.bmp in the same location. 5. Open these three graphics files in new sessions of IrfanView and compare the files. Document any changes you notice. 6. Open Flower.gif from your work folder, and save it as Flower.jpg in the same location. If your screen is cluttered with too many open IrfanView windows, close a few that you’re no longer working with. 7. Save Flower.jpg as Flower2.gif in the same location. 10 420 Chapter 10 8. Open these three graphics files in new sessions of IrfanView, and document any changes you see when comparing the files. 9. Open Cartoon.bmp from your work folder, and save it as Cartoon.gif in the same location. 10. Save Cartoon.gif as Cartoon2.bmp in the same location. 11. Open these three graphics files in new sessions of IrfanView, and document any changes you see when comparing the files. 12. Exit all instances of IrfanView. Summarize your conclusions in a brief report and submit it to your instructor. Hands-On Project 10-4 In this project, you use S-Tools4 to create a steganography file for hiding an image. Download S-Tools4 from www.stegoarchive.com, install the program, and then follow these steps: 1. In Windows Explorer, navigate to where you installed S-Tools4, and start the program by double-clicking S-Tools.exe. 2. Drag Rushmore.bmp from your work folder to the S-Tools window. 3. To hide text in the Rushmore.bmp file, drag findme.txt from your work folder to the Rushmore.bmp image. 4. In the Hiding 99 bytes dialog box, type FREEDOM in the Passphrase and Verify passphrase text boxes, and then click OK. A hidden data window opens in the S-Tools window. 5. Right-click the hidden data window and click Save as. Save the image as Steg.bmp in your work folder. 6. Close the Steg.bmp and Rushmore.bmp windows, but leave S-Tools open for the next project. Hands-On Project 10-5 In this project, you use S-Tools4 to create a secret message in a bitmap file and compare this steganography file to the original file by using the DOS Comp command. You need S-Tools4 and the Mission.bmp and USDECINP.rtf files in your work folder. Follow these steps to create a steganography file: 1. If you have exited S-Tools4, start it by double-clicking S-Tools.exe in Windows Explorer. 2. Drag Mission.bmp from your work folder to the S-Tools window. 3. Next, drag USDECINP.rtf from your work folder to the Mission.bmp image. 4. Type hop10-5 in the Passphrase and Verify passphrase text boxes, and then click OK. A hidden data window opens in the S-Tools window. 5. Right-click the hidden data window and click Save as. Save the image as Mission-steg.bmp in your work folder. Exit S-Tools. Case Projects 421 Next, you use the DOS Comp command to compare these two files and redirect the output to a text file for further analysis: 1. Click Start, type cmd in the Start Search text box, and then press Enter. (In Windows XP, click Start, Run, type cmd, and click OK.) 2. Change to your work folder by typing cd \Work\Chap10\Projects (substituting the path to your work folder) and pressing Enter. 3. Type comp Mission.bmp Mission-steg.bmp > Mission-compare.txt and press Enter, and then at the Compare more files (Y/N) ? prompt, type n and press Enter. 4. Open the Mission-compare.txt file to see what discrepancies were found. When you’re finished, close the file, and exit the command prompt window by typing exit and pressing Enter. 5. To complete this project, write a one-page report on the number of mismatches and the deviation in each mismatch between the two files. In addition, state your observations of the differences in the two files, such as hexadecimal values and their patterns. Case Projects Case Project 10-1 Continue your analysis of the image file for your investigation of the arson running case project. Determine whether any incriminating images are contained in the evidence. Include the location of the file when you document any images you believe to be of evidentiary value. Case Project 10-2 Do an Internet search to find current steganography tools. Create a spreadsheet listing at least five steganography tools and their features. The spreadsheet should have the following columns: name of tool, vendor (with URL for purchasing or downloading the tool), cost (or note that it’s freeware, if applicable), and file formats of data that can be hidden. Case Project 10-3 You’re investigating a case involving an employee who’s allegedly sending inappropriate photos via e-mail in attachments that have been compressed with a zip utility. As you examine the employee’s hard disk, you find a file named Orkty.zip, which you suspect is a graphics file. When you try to open the file in an image viewer, a message is displayed indicating that the file is corrupt. Write a two- to three-page report explaining how to recover Orkty.zip for further investigation. 10 422 Chapter 10 Case Project 10-4 You work for a mid-size corporation known for its inventions that does a lot of copyright and patent work. You’re investigating an employee suspected of selling and distributing animations created for your corporation. During your investigation of the suspect’s drive, you find some files with the unfamiliar extension .cde. The network administrator mentions that other .cde files have been sent through an FTP server to another site. Describe your findings after conducting an Internet search for this file extension. What is true about JPEG and TIF files?Which of the following is true about JPEG and TIF files? They have different values for the first 2 bytes of their file headers. When viewing a file header, you need to include hexadecimal information to view the image. When investigating graphics files, you should convert them into one standard format.
How can you identify an unknown graphics file format that is unrecognized by your forensics tool?Explain how to identify an unknown graphics file format that your digital forensics tool doesn't recognize. You need to examine a copy of the unknown file with a hexadecimal editor to find the hex code for the first several bytes of the file.
Can graphics files stored on a computer be recovered after they are deleted?Graphics files stored on a computer can't be recovered after they are deleted.
|
When you carve a graphics file, recovering the image depends on which of the following skills?
Urheberrechte © © 2024 defrojeostern Inc.
